path: root/source4/lib/tls/tls_tstream.c

/*
   Unix SMB/CIFS implementation.

   Copyright (C) Stefan Metzmacher 2010

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "includes.h"
#include "system/network.h"
#include "system/filesys.h"
#include "system/time.h"
#include "../util/tevent_unix.h"
#include "../lib/tsocket/tsocket.h"
#include "../lib/tsocket/tsocket_internal.h"
#include "../lib/util/util_net.h"
#include "lib/tls/tls.h"

#if ENABLE_GNUTLS
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>

#define DH_BITS 2048

#if defined(HAVE_GNUTLS_DATUM) && !defined(HAVE_GNUTLS_DATUM_T)
typedef gnutls_datum gnutls_datum_t;
#endif

/*
 * define our own values in a high range
 */
#ifndef HAVE_DECL_GNUTLS_CERT_EXPIRED
#define GNUTLS_CERT_EXPIRED                    0x10000000
#define REQUIRE_CERT_TIME_CHECKS 1
#endif
#ifndef HAVE_DECL_GNUTLS_CERT_NOT_ACTIVATED
#define GNUTLS_CERT_NOT_ACTIVATED              0x20000000
#ifndef REQUIRE_CERT_TIME_CHECKS
#define REQUIRE_CERT_TIME_CHECKS 1
#endif
#endif
#ifndef HAVE_DECL_GNUTLS_CERT_UNEXPECTED_OWNER
#define GNUTLS_CERT_UNEXPECTED_OWNER           0x40000000
#endif

#endif /* ENABLE_GNUTLS */

const char *tls_verify_peer_string(enum tls_verify_peer_state verify_peer)
{
	switch (verify_peer) {
	case TLS_VERIFY_PEER_NO_CHECK:
		return TLS_VERIFY_PEER_NO_CHECK_STRING;

	case TLS_VERIFY_PEER_CA_ONLY:
		return TLS_VERIFY_PEER_CA_ONLY_STRING;

	case TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE:
		return TLS_VERIFY_PEER_CA_AND_NAME_IF_AVAILABLE_STRING;

	case TLS_VERIFY_PEER_C